netdev - [PATCH net-next v2 4/6] net: trust the bitmap in __dev_alloc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20231023152346.3639749-5-kuba@kernel.org>
Date: Mon, 23 Oct 2023 08:23:44 -0700
From: Jakub Kicinski <kuba@...nel.org>
To: davem@...emloft.net
Cc: netdev@...r.kernel.org,
	edumazet@...gle.com,
	pabeni@...hat.com,
	johannes.berg@...el.com,
	mpe@...erman.id.au,
	j@...fi,
	jiri@...nulli.us
Subject: [PATCH net-next v2 4/6] net: trust the bitmap in __dev_alloc_name()

Prior to restructuring __dev_alloc_name() handled both printf
and non-printf names. In a clever attempt at code reuse it
always prints the name into a buffer and checks if it's
a duplicate.

Trust the bitmap, and return an error if its full.

This shrinks the possible ID space by one from 32K to 32K - 1,
as previously the max value would have been tried as a valid ID.
It seems very unlikely that anyone would care as we heard
no requests to increase the max beyond 32k.

Signed-off-by: Jakub Kicinski <kuba@...nel.org>
---
v2:
 - mention the loss of 1 entry in the commit message
---
 net/core/dev.c | 15 ++++-----------
 1 file changed, 4 insertions(+), 11 deletions(-)

diff --git a/net/core/dev.c b/net/core/dev.c
index bbfb02b4a228..d2698b4bbad4 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1119,18 +1119,11 @@ static int __dev_alloc_name(struct net *net, const char *name, char *res)
 
 	i = find_first_zero_bit(inuse, max_netdevices);
 	bitmap_free(inuse);
+	if (i == max_netdevices)
+		return -ENFILE;
 
-	snprintf(buf, IFNAMSIZ, name, i);
-	if (!netdev_name_in_use(net, buf)) {
-		strscpy(res, buf, IFNAMSIZ);
-		return i;
-	}
-
-	/* It is possible to run out of possible slots
-	 * when the name is long and there isn't enough space left
-	 * for the digits, or if all bits are used.
-	 */
-	return -ENFILE;
+	snprintf(res, IFNAMSIZ, name, i);
+	return i;
 }
 
 /* Returns negative errno or allocated unit id (see __dev_alloc_name()) */
-- 
2.41.0